CVE-2026-28519 - Vulnerability Analysis

Overview

arduino-TuyaOpen < 1.2.1 contains a heap-based buffer overflow caused by malicious DNS responses in the DnsServer component, letting attackers on the same LAN execute arbitrary code, exploit requires LAN DNS server control.

Severity & Score

Impact

Attackers controlling LAN DNS can execute arbitrary code on affected embedded devices, leading to full device compromise.

Mitigation

Update to version 1.2.1 or later.

References

• https://github.com/tuya/arduino-TuyaOpen
• https://src.tuya.com/announcement/32
• https://www.vulncheck.com/advisories/arduino-tuyaopen-dnsserver-heap-based-buffer-overflow-remote-code-execution

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 16, 2026

🟠 CVE-2026-28519 - High (8.8) arduino-TuyaOpen before version 1.2.1 contains a heap-based buffer overflow vulnerability in the DnsServer component. An attacker on the same local area network who controls the LAN DNS server can send malicious DNS responses to overflow the heap ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28519/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner